Screening and risk
Why screening hits are raised and remembered, how lists and exclusions work, and how customer risk ratings are calculated and overridden.
tocOn this page
- Screening hits
- Why was this hit raised?
- Why doesn't a hit I cleared come back?
- What if the list entry changed after the hit was raised?
- Why does my clear need a second person?
- What is the difference between statutory and policy lists?
- What happens when a list is updated?
- What is the difference between an exclusion and a clear?
- What are PEPs and RCAs?
- Customer risk ratings
- How is a customer's risk rating calculated?
- What is a floor rule?
- What is the platform reference model?
- Can I override a rating?
- When is EDD triggered?
- Does a screening hit change the risk rating?
- Why is a customer shown as Unrated?
- Related
Screening and customer risk rating are two of the most closely examined parts of any AML programme. This page explains how FlowSentry raises and remembers screening hits, how the different lists behave, and how a customer's risk rating is built, overridden and followed up.
Screening hits
Why was this hit raised?
A hit is raised when a customer, or a director or beneficial owner of a corporate customer, scores above the matching threshold against a list entry. Open the hit from Hits (/screening) to see:
- Side by side: the subject and the list entry, with matched words highlighted
- a Reading for each attribute (date of birth, nationality or country, identifier, type): agrees, close or differs
- Why this hit: a plain-English explanation
- Score breakdown: how the name similarity was measured against the threshold
You can also use Explain this match for an AI reading. Both explanations are advisory and never change the engine's score.
Why doesn't a hit I cleared come back?
A clear is remembered for that subject and that list entry. FlowSentry does not raise the same pair again unless either side changes, for example the customer's details are updated or the list entry is amended. Single-eyed clears are sampled for QA.
What if the list entry changed after the hit was raised?
The hit shows "The list entry has changed (or been removed) since this hit was raised." Review it against the current entry before deciding.
Why does my clear need a second person?
Your institution's Four-eyes policy sets a score above which a clear needs a checker. True matches and clears on statutory lists always need two people. In those cases your decision becomes Clear proposed or True match proposed, and a checker confirms it with a fresh second factor. You can never check your own proposal.
What is the difference between statutory and policy lists?
| Statutory lists | Policy lists | |
|---|---|---|
| Examples | UN Security Council, Kenya domestic designations | OFAC SDN and other lists your institution chooses |
| Screening | Always screened; cannot be unsubscribed | Can be unsubscribed with a reason and step-up |
| Decisions | Every clear and true match needs two people | Follows your four-eyes policy |
| Queue order | Shown first; overdue after one day open | Ordered by risk or score |
Statutory hits carry the Statutory TFS list badge, because they relate to targeted financial sanctions.
What happens when a list is updated?
Activating a new list version rescreens your whole customer book. A source file that fails validation, for example a broken format, a large unexplained drop in records or an older publication date, is quarantined and never screened. For domestic designations, each activation also produces a nil or positive certificate you can download.
What is the difference between an exclusion and a clear?
A clear decides one hit. An exclusion (a "good-guy" exclusion) records that a known customer is not the listed party, so screening skips that pair while the exclusion is in force. A list manager proposes it with a reason and an expiry of at most three years, and a checker approves it with step-up. Exclusions apply to real-time, onboarding and rescreen screening, and the page shows those expiring in the next 30 days.
What are PEPs and RCAs?
A politically exposed person (PEP) holds, or has held, a prominent public function. A relative or close associate (RCA) is linked to a PEP, so designating an RCA requires the related PEP. The PEP register records each designation with category, source and rationale. Declassification is requested with a reason and decided by a different checker with step-up, and designations older than 12 months appear under reviews due.
Customer risk ratings
How is a customer's risk rating calculated?
Customers are rated automatically when they are loaded or changed, with a regular catch-up for anyone missed. The score runs from 0 to 100 and is built from five factor groups:
- Customer
- Geography
- Product
- Channel
- Behaviour
Each factor contributes its group weight × factor weight × factor score. The score falls into a band: Low, Medium, High or Very high. The customer's Risk tab shows How the score is made up, with a plain-English reason for each bar, plus the Score history.
What is a floor rule?
A floor rule sets a minimum band regardless of the score. For example, a domestic PEP is never rated below Medium. "Prohibited" can be a rule outcome but is never a band.
What is the platform reference model?
Until your institution activates its own risk model, customers are rated with the platform reference model, shown as "Platform reference · uncalibrated". Your risk manager can draft a calibrated version from it, test it in the What-if simulator and send it for approval. The MLRO or Deputy MLRO activates it with step-up.
Can I override a rating?
Yes, under maker-checker. Select Propose override, choose the band, give a Reason for the override of at least 20 characters and an expiry of at most one year, then Submit for approval. A different person with model-approval rights approves with step-up. The calculated score is still recorded, and the risk tab shows an Overridden badge.
When is EDD triggered?
An enhanced due diligence case opens automatically when a customer's effective band is High, including through an override. The checklist is worked in the EDD workbench and signed off by a senior approver who did not submit it.
Does a screening hit change the risk rating?
Only a confirmed true match triggers a re-score. Potential or cleared hits do not.
Why is a customer shown as Unrated?
The customer has not yet been scored, usually because they were loaded very recently. The catch-up rates anyone missed shortly afterwards. Authorised users can also select Rescore now on the customer's risk tab.